Loading...
With the development of email security, Verified Mark Certificates (VMCs) and Common Mark Certificates (CMCs) have become critical for organisations that want to showcase their brand logos in email clients using the BIMI (Brand Indicators For Message Identification) standard.
Before an organisation’s logo appears in a recipient’s inbox, however, it must undergo a rigorous validation process to prove it is a legitimate entity.
This strict validation process will not be arbitrary; the same high-assurance framework that is used for Extended Validation (EV) certificates will be used to provide assurance that only legitimate, trustworthy entities can visually represent their brands through email.
Why Validation is Critical for VMC and CMC?
When thinking of validation for both VMC and CMC, you must think of trust when it comes to email, as email is a primary means of phishing and impersonating brands, and if you do not have proper verification, then attackers could use your logos to deceive users.
By Enforcing Strict Validation:
- Only Legitimate Organisations Will Display Logos
- Reduced Risk of Brand Impersonation
- Users Gain Visual Trust Indicators in their Inbox
Thus, validation is truly a foundational requirement and not just a process.
| Product | Requirement | |
|---|---|---|
| DigiCert Verified Mark Certificate | Trademark Logo Required | Buy Now |
| DigiCert Common Mark Certificate | No Trademark Required | Buy Now |
Legal Identity and Existence Verification
The first and main part of the process for obtaining a VMC or CMC certificate is verifying that the organisation has been incorporated as a real operating entity in accordance with law and is in good standing.
The verification of the legal identity of the organization and its existence will confirm that the requesting organization exists and can maintain its legal standing to be issued a certificate.
All types of organizations have varying levels of verification necessary to confirm the organization’s legal identity and existence.
Private Organizations
Private companies must demonstrate that the company is incorporated or registered to do business under law as well as be in good standing, and the name of the company must match that given in the certificate request.
Private companies must submit documentation to verify their registration, including a registration number and evidence that the company is in good standing, before the certificate can be issued.
Government Entities
All government entities must be recognised as legal entities in the jurisdiction where they operate. The verification process for these entities typically includes reviewing recorded legislation, examining the public registry of corporations (if applicable), and assessing the credibility of government-issued documents that confirm the entity’s legal existence.
Business Entities (Sole Proprietors)
A sole proprietor will be verified by both the business registration and the physical identity of the sole proprietor. Because verification for sole proprietors has stricter standards than other business entity types, the verification of the physical identity of the sole proprietor is used to establish accountability for the activities of the business owner.
Non-Commercial Entities
An organisation must provide adequate documentation to demonstrate its recognition by virtue of international municipal law or as a recognised government entity for non-commercial/public non-profit organisations, such as an international organisation, and, in general, demonstrate proof of the establishment or existence of a non-commercial/public non-profit entity.
Also Read: How to Trademark Your Brand Logo to Qualify for Verified Mark Certificate?
Trusted Verification Sources
To verify an organisation’s legitimacy, verification specialists will consult various trusted data sources. These are:
- Qualified Government Information Sources (QGIS): Official databases maintained by government entities that provide authoritative records.
- Qualified Independent Information Sources (QIIS): Third-party business directories that maintain their own credible records.
- Qualified Tax Information Sources (QTIS): Tax records maintained by governments that provide proof of operational status.
- Verified Professional Letters (VPL): Official documents authored by an attorney and/or accountant that verify the basic facts about the organisation.
With multiple sources of verification, there is greater security against fraud and misinformation due to layered verification methods.
Face-to-Face (F2F) Identity Verification
If the automated process reports an inconclusive result, a live video call may be required before an individual is permitted to obtain the certificate. This hybrid solution provides the most accurate and secure identity verification process.
A secure F2F verification process will typically include:
- A live video ID verification session.
- AI-based checks, such as liveness detection;
- Validation of a government-issued photo ID;
- Final review from a human validator.
If the automated process reports an inconclusive result, a live video call may be required before an individual is permitted to obtain the certificate. This hybrid solution provides the most accurate and secure identity verification process.
Assumed Name (DBA) Validation
Many businesses and organisations operate under an assumed name or “Doing Business As” (DBA) name. Therefore, it is important to validate the DBA name.
The steps taken to validate the DBA include:
- Verifying the DBA with either the database of the Secretary of State or through an Accepted Professional Letter;
- Confirming the DBA is registered in the governing jurisdiction.
Validating a DBA name is necessary in order to prevent misuse of unverified brand names and to ensure that the logo being displayed accurately represents a legitimate entity.
Physical Address Verification
The other primary requirement is verifying the physical business address of the company. The address must be:
- A valid operational location
- Not a PO Box or mail forwarding service
- Verified through reliable data sources, including QGIS, QIIS, QTIS or VPL
If the address is located outside of the country the company is incorporated in, it may require additional verification to verify that the company has a legitimate business operation with a verifiable physical location.
The Bigger Picture: Trust in Email Ecosystems
VMC and CMC verification is more than just compliance. It is an essential trust mechanism within the modern email community.
By Combining:
- Legal verification,
- Multi-source data validation,
- Identity verification
- Real-world address confirmation
In one process that allows only genuine, validated businesses to represent brand indicators on email clients.
Conclusion
From the ground to the legal identity verification process to achieving the EV level of validation, Certera has simplified each step of the VMC/CMC issuance process.
From helping you with your documentation/preparation to assisting you with domain verification and legitimacy checks, Certera provides expert support to make the process smooth and easy.
